EUVD-2025-22024

Malicious code in bioql PyPI...

CVE-2025-11221 Remote Code Execution in GTONE ChangeFlow

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal', Unrestricted Upload of File with Dangerous Type vulnerability in GTONE ChangeFlow allows Path Traversal, Accessing Functionality Not Properly Constrained by ACLs.This issue affects ChangeFlow: from All versions through...

GTONE ChangeFlow 安全漏洞

GTONE ChangeFlow is an application change management software from GTONE Korea. A security vulnerability exists in GTONE ChangeFlow v9.0.1.1 and prior versions, which stems from improper pathname restrictions and unrestricted uploads of dangerous file types, which could lead to improper path...

PT-2025-39512

Name of the Vulnerable Software and Affected Versions WP-DownloadManager plugin for WordPress versions prior to 1.68.12 Description The WP-DownloadManager plugin for WordPress is susceptible to unrestricted file uploads because of a lack of file type validation within the download-add.php file...

CVE-2025-10669

CVE-2025-10669 affects Airsonic-Advanced up to version 10.6.0 and is linked to the Playlist Upload Handler. The issue allows manipulation leading to unrestricted uploads, with remote initiation possible and public exploits available. Several sources (including PT-2025-38382) indicate a fix is to ...

CVE-2025-10600

CVE-2025-10600 affects SourceCodester Online Exam Form Submission 1.0, specifically the /register.php endpoint where manipulation of the img parameter enables unrestricted file uploads. The connected documents confirm remote exploitation with an exploit published, indicating an attacker could upl...

Mattermost Server 9.11.x < 9.11.18 / 10.5.x < 10.5.9 / 10.8.x < 10.8.4 / 10.9.x < 10.9.3 / 10.10.x < 10.10.1 / 10.11.0 Unrestricted Upload of File (MMSA-2025-00505)

The version of Mattermost Server installed on the remote host is affected by a vulnerability as referenced in the MMSA-2025-00505 advisory. - Mattermost versions 10.8.x = 10.8.3, 10.5.x = 10.5.8, 9.11.x = 9.11.17, 10.9.x = 10.9.2, 10.10.x = 10.10.0 fail to validate upload types in remote cluster...

Multiple vulnerabilities in SS1

Overview SS1 provided by provided by DOS Co., Ltd. contains multiple vulnerabilities listed below. Inadequate encryption strength CWE-326 - CVE-2025-46409 Files or directories accessible to external parties CWE-552 - CVE-2025-52460 Incorrect permission assignment for critical resource CWE-732 -...

CVE-2025-43766

The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows the upload of unrestricted files in the style books component that are processed within the environme...

PT-2025-34506 · Liferay · Liferay Portal +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.3.3.131 and earlier, 7.4.0 through 7.4 GA update 92 Liferay DXP versions 2024.Q1.1 through 2024.Q1.12 Liferay DXP versions 2024.Q2.0 through 2024.Q2.13 Liferay DXP versions 2024.Q3.1 through 2024.Q3.13 Liferay DXP...

PT-2025-32456 · Unknown · Qiyuesuo Eelectronic Signature Platform

Name of the Vulnerable Software and Affected Versions: Qiyuesuo Eelectronic Signature Platform versions up to 4.34 Description: A critical issue exists in Qiyuesuo Eelectronic Signature Platform, potentially allowing for unrestricted file uploads. The execute function within the /api/code/upload...

CVE-2025-50848

A file upload vulnerability was discovered in CS Cart 4.18.3, allows attackers to execute arbitrary code. CS Cart 4.18.3 allows unrestricted upload of HTML files, which are rendered directly in the browser when accessed. This allows an attacker to upload a crafted HTML file containing malicious...

Viglet Shio CMS 安全漏洞

Viglet Shio CMS is a content management system from Viglet Open Source. A security vulnerability exists in Viglet Shio CMS version 0.3.8 and earlier, which stems from a misbehavior of the parameter filename in the file shio-app/src/main/java/com/viglet/shio/api/staticfile/ShStaticFileAPI.java tha...

CVE-2025-8265

A vulnerability classified as critical has been found in 299Ko CMS 2.0.0. This affects an unknown part of the file /admin/filemanager/view of the component File Management. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclose...

CVE-2025-8256

A vulnerability classified as critical has been found in code-projects Online Ordering System 1.0. Affected is an unknown function of the file /admin/product.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has bee...

CVE-2025-8171

A vulnerability, which was classified as critical, has been found in code-projects Document Management System 1.0. This issue affects some unknown processing of the file /insert.php. The manipulation of the argument uploadedfile leads to unrestricted upload. The attack may be initiated remotely...

SMG Software Information Portal 代码问题漏洞

SMG Software Information Portal is an information portal product from SMG Software, Turkey. A code issue vulnerability exists in SMG Software Information Portal, which arises from the unrestricted upload of dangerous types of files and improper neutralization of special elements, which could lead...

CVE-2025-54442

Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0...

PT-2025-29503 · Yijiusmile · Kkfileviewofficeedit

Name of the Vulnerable Software and Affected Versions: YiJiuSmile kkFileViewOfficeEdit affected versions not specified Description: A critical issue exists in the fileUpload function of the /fileUpload endpoint, allowing for unrestricted file uploads. The File argument can be manipulated to achie...

CVE-2025-7190

A vulnerability, which was classified as critical, was found in code-projects Library Management System 2.0. This affects an unknown part of the file /admin/studenteditphoto.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to initiate the attack remotely. T...